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DETAILED ACTION 
Claim Rejections - 35 USC § 103 

1. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and tiie prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

2. Claims 1,2,4,9,10,12,16,17,19,23-25 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Hegde (US006570875B1) in view of Blandy (US005884080A). 

Regarding claims 1, 9 and 16, Hegde discloses a network node (see FIG. 2, 
Multiprotocol Switch 40) for collecting network traffic data having one or more processing 
engines (see FIG. 2, CPU 80) and a memory (see FIG. 2, Shared Memory 90) comprising a set of 
instructions to: 

receive a group of information (see FIG. 2, Input/output ports 50 receive IP packet; see 
col. 4, Hues 34-53, see col. 5, lines 30-50; see FIG. 7, S30 and S32; see col. 8, lines 250 to col. 9, 
lines 390); 

determine whether to process the group of information for network traffic data collection 
(see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, lines 9; see col. 9, lines 40-55; note that IP 
header is extracted and determined if the flow (i.e. source and destination) is in the flow table for 
updating/creating the new forwarding information in the flow table 70 (also see FIG. 5)), 

wherein said determining is performed according to an algorithm (see FIG. 8-9, 
method/algorithm) that is selected from one of 
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selecting the group of information based on an examination of traffic attribute data (see 
FIG. 8, checking/getting/evaluation addresses in the packet header) in the group of information 
(see col. 9, lines 44-55; see col. 10, lines 35-42); 

process the group of information for network traffic data collection if the determination is 
to process the group of information (see FIG. 9, S72, S94; see col. 3, lines 3-5, see col. 10, lines 
36-44, see col. 11, lines 65 to col. 12, lines 5; note that the new forwarding information is created 
in the flow table when the flow from extracted IP header is not in the flow table; also see FIG. 10 
for recording/collecting the entries in the flow table); and 

forward the group of information to the destination (see FIG. 8, S46, S50; see col. 3, line 
4-10, see col. 10, lines 24-32; note that once the flow is identified and the address is resolved, the 
IP packet is forwarded according to the designated flow); 

Hegde does not explicitly disclose a burst sampling. However, Blandy teaches 
determining is perforaied according to a sampling algorithm (see FIG. 2 and 3, sampling 
method) that is selected from one of a burst sampling algorithm (see col. 2, lines 64-66; see col. 
3, lines 12-19; col. 4, Hues 26-50; sampling burst method); and 

selecting the group of information based on an examination of traffic attribute data in the 
group of information (see FIG. 2, 33-39; see FIG. 3, 41-58; see col. 4, lines 30 to col. 6, lines 26; 
setting/allocating data according to time/count of traffic data). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to provide a 
burst sampling algorithm, as taught by Blandy in the system of Hegde, so that it would provide a 
performance system monitor system performance with minimal changes to the operating system 
and no changes to application code; also it would provides mechanism for monitoring system 
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performance by sampling in a burst mode, rather than once per interrupt; see Blandy col. 2, line 
55 to col. 3, lines 10. 

Regarding claims 2, 10 and 17, Hegde'875 discloses wherein the group of information is 
an IP packet (see FIG. 2, IP packet; see col. 4, lines 34-53, see FIG. 7, S32; IP packet see col. 8, 
lines 250 to col. 9, lines 390; see col. 5, lines 30-50). 

Regarding claims 4, 12 and 19, the combined system of Hegde'875 and Blandy 
discloses wherein forwarding the group of information to the destination as described in claim 1. 

Hegde'875 further discloses identifying the destination (see FIG. 8, S44, an entry of a 
flow) using a forwarding table (see FIG. 2 and FIG. 5, Flow Table 70; see col. 2, lines 65 to col. 
3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the flow entry 
is in the flow table); 

if the destination is in the forwarding table (see FIG. 8, S46; the entries in the flow table 
is Yes), automatically forwarding the group of information to the destination (see FIG. 8, S46; 
note that the packet is forwarded according to a flow in the flow table at wire speed; see col. 3, 
lines 6-7; col. 9, lines 50-55) and 

otherwise sending the group of information to one or more processing engines to 
determine routing to the destination (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, 
lines 2-6; note that when there is no entry of a flow in the flow table, the packet is forwarded to 
CPU to be processed. See FIG. 9, S88, S90, S94; the CPU determines and creates/updates the 
table with new forwarding information; see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, 
lines 36-44, see col. 11, lines 65 to col. 12, lines 5) and 
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forwarding the group of information according to the determined routing (see FIG. 8, 
S46, S50; see col. 3, line 4-10, see col. 10, lines 24-32; note that once the flow is identified and 
the address is resolved, the IP packet is forwarded according to the created/updated designated 
flow). 

Regarding claim 5, Hegde'875 discloses wherein forwarding the group of information to 
the destination (see FIG. 8, S46; forwarding packet according to the flow table) is performed 
after processing the group of information (see FIG. 8, S40, S42 and S44; getting, checking and 
determining the IP packet for a flow; see col. 9, lines 44-49; note that forwarding IP packet 
according to the designated step is executed after the step of processing IP packet for a flow 
information is performed). 

Regarding claim 23, Hegde'875 discloses an apparatus (see FIG. 2, Multiprotocol 
Switch 40) for collecting network traffic data comprising: 

one or more switch fabrics (see FIG. 2, Switch Module 60) ; 

one or more destination line cards (see FIG. 1 and 2, transmitting ports of the 
Input/output ports 50-1 . . .50-N which interface with network nodes, also each port must be on 
the card) coupled to the one or more switch fabrics (see FIG. 2, Input/output ports 50 is 
comiected to Switch Module 60; see col. 4, lines 34-53); 

a source line card (see FIG. 1 and 2, receiving ports of the Input/output ports 50-1 . . .50-N 
which interface with network nodes, also each port must be on the card) coupled to the one of the 
one or more switch fabrics (see FIG. 2, Input/output ports 50 is connected to Switch Module 60; 
see col. 4, lines 34-53) wherein 
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the source line card receive a data packet (see FIG. 2, receiving ports of Input/output 
ports 50 receive IP packet; see col. 4, lines 34-53, see FIG. 7, S30 and S32; see col. 8, lines 250 
to col. 9, lines 390); 

a router processor (see FIG. 2, CPU 80), couple to switch fabric (see FIG. 2, Switch 
Module 60), and configured to 

determine whether to process the data packet for network traffic data collection according 
to an algorithm (see FIG. 8-9, method/algorithm; see FIG. 8, S42, S44; see col. 2, lines 65 to col. 
3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the flow (i.e. 
source and destination) is in the flow table for updating/creating the new forwarding information 
in the flow table 70 (also see FIG. 5)); 

process the data packet for network traffic data collection if the determination is to 
process the data packet (see FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 36-44, see 
col. 1 1, lines 65 to col. 12, lines 5; note that the new forwarding information is created in the 
flow table when the flow from extracted IP header is not in the flow table; also see FIG. 10 for 
recording/collecting the entries in the flow table); and 

forward the data packet to one of the one or more destination line cards (see FIG. 8, S46, 
S50; see col. 3, line 4-10, see col. 10, lines 24-32; note that once the flow is identified and the 
address is resolved, the IP packet is forwarded to the destination, thereby forwarding to output 
port 50). 

Hegde does not explicitly disclose a sampling. However, Blandy teaches determining is 
performed according to a sampling algorithm (see FIG. 2 and 3; col. 2, lines 64-66; see col. 3, 
lines 12-19; col. 4, lines 26-50; sampling burst method). 
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Therefore, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to provide a burst sampling algorithm, as taught by Blandy in the system 
of Hegde, so that it would provide a performance system monitor system performance with 
minimal changes to the operating system and no changes to application code; also it would 
provides mechanism for monitoring system performance by sampling in a burst mode, rather 
than once per interrupt; see Blandy col. 2, line 55 to col. 3, lines 10. 

Regarding Claim 24, claim which that substantially discloses all the limitations of the 
respective claim 2. Therefore, iX is subjected to the same rejection. 

Regarding claim 25, the combined system of Hegde and Blandy discloses all the 
limitations. Hegde discloses an algoritlun (see FIG. 8-9, method/algorithm) that is selected from 
one of 

selecting the data packet based on an examination of traffic attribute data (see FIG. 8, 
checking/getting/evaluation addresses in the packet header) in the data packet (see col. 9, lines 
44-55; see col. 10, lines 35-42). 

Blandy teaches determining is performed according to a sampling algorithm (see FIG. 2 
and 3, sampling method) that is selected from one of a burst sampling algorithm (see col. 2, lines 
64-66; see col. 3, lines 12-19; col. 4, lines 26-50; sampling burst method); and 

selecting the data packet based on an examination of traffic attribute data in the data 
packet (see FIG. 2, 33-39; see FIG. 3, 41-58; see col. 4, lines 30 to col. 6, lines 26; 
setting/allocating data according to time/count of traffic data). Therefore, it would have been 
obvious to one having ordinary skill in the art at the time the invention was made to provide a 
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burst sampling algorithm, as taught by Blandy in the system of Hegde, for the same motivation 
as stated above in claim 1 . 

3. Claim 6, 13 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hegde'875 and Blandy, as applied to claims 1,9 and 16 above, and further in view of Dietz (U.S. 
6,651,099). 

Regarding claims 6, 13 and 20, Hegde'875 discloses determining if the group of 
information is part of one or more recorded traffic flows (see FIG. 8, S42, S44; see col. 2, lines 
65 to col. 3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the 
traffic flow is in the flow table); 

creating a new entry in a table if the group of information is not part of the one or more 
recorded traffic flows (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, lines 2-6; note 
that when there is no entry of a flow in the flow table, the packet is forwarded to CPU to be 
processed. See FIG. 9, S88, S90, S94; the CPU updates the table with a new traffic flow; see 
FIG. 9, S72, 394; see col. 3, lines 3-5,see col 10, lines 36-44, see col. 11, lines 65 to col. 12, 
lines 5); 

forwarding if the group of information is part of the one or more recorded traffic flows 
(see FIG. 8, S46, S50; see FIG. 12, SI 76; see col. 3, line 4-10, see col. 10, lines 24-32; note that 
once the flow is identified and the address is resolved, the IP packet is forwarded according to 
the created/updated designated flow). 

Neither Hegde'875 nor Blandy explicitly disclose incrementing a field in an existing 
entry in the table; and time stamping the group of information. 
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However, the above-mentioned claimed limitations are taught by Dietz'099. In particular, 
Dietz'099 teaches incrementing a field (see col. 24, lines 55-56, see col. 14, lines 54-56; a packet 
count in the counters, and note that when counting, the data must be incremented) in an existing 
entry in the table (see FIG. 3, Flow entry database) if the group of information is part of the one 
or more recorded traffic flows (see FIG. 3, steps 316 and 322; see col. 14, lines 3-35, 48-57; see 
col. 24, lines 50-59; note that when the packet is found to have a match flow-entry in the 
database 324, the calculator enters the measured statistical data in the flow-entry); and 

time stamping the group of information (see col. 20, line 40-65; note that the time stamps 
are generated, collected, and analyzed for each packet of the flow). 

In view of this, having the combined system of Hegde'875 and Blandy, then given the 
teaching of Dietz'099, it would have been obvious to one having ordinary skill in the art at the 
time the invenfion was made to modify the combined system of Hegde'875 and Blandy, for the 
purpose of providing a mechanism of collecting traffic flows in the flow-entry database by 
utilizing counters, and time stamping the packet, as taught by Dietz'099, since Dietz'099 states 
the advantages/benefits at col. 4, lines 40 to col. 5, lines 10 that it would recognize and classify 
all flows that pass either direction of the network and tune the performance of the network. The 
motivation being that by collection the traffic flow information, it enhance the perfonnance of 
the network since the resources are being monitored and occurrences of specific sequences of 
packets are being reported. 
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4. Claim 7,8,14,15,21, and 22 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Hegde'875, Blandy and Dietz'099, as applied to claim 6,13, and 20 above, and fiirther in 
view of Takase (U.S. 5,822,535). 

Regarding claims 7, 14 and 21, the combined system of Hegde'875, Blandy and 
Dietz'099 discloses the processing of the group of information for network traffic data collection 
as described above in claims 1 and 6. Hegde further discloses a network traffic data collection 
application (see FIG. 2, Flow Table 70). Dietz'099 also discloses a network traffic data collection 
application (see FIG. 11, Lookup/update Engine LUE 1 107). 

Neither Hegde'875, Blandy nor Dietz'099 explicitly disclose creating a traffic information 
packet; and transmitting the traffic information packet. 

However, the above-mentioned claimed limitations are taught by Takase'535. In 
particular, Takase'535 teaches creating a traffic information packet (see FIG. 17B, Response 
Packet; see col. 2, lines 55-61; see col. 20, lines 5-30; see FIG. 7, Steps S5-S7; note that upon 
receiving the call/request packet 401 from the management node 100, the managed node 301 
creates a response packet after collecting and accumulating according to the inquiry); and 

transmitting the traffic information packet to a network traffic data collection application 
(see FIG. 2, software application Management system 400 of the Management node 100; see 
FIG. 7, S8; the response packet is transmitted to the software application management system 
400; see col. 7, lines 50 to col. 9, lines 6). 

In view of this, having the combined system of Hegde'875, Blandy and Dietz'099, then 
given the teaching of Takase'535, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to modify the combined system of Hegde'875, Blandy and 
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Takase'535, for the purpose of providing a mechanism of transmitting a collected response 
packet to the collection management application system upon inquiry, as taught by Takase'535, 
since Takase'535 states the advantages/benefits at col. 2, lines 45 to col. 3, lines 40 that it would 
reduce the amount of traffic flow in the network by preventing concentration of network load. 
The motivation being that by transmitting collected response packet only upon request to the 
management software application, it can reduce the network congestion since the collected 
packet is transmitted only upon request. 

Regarding claims 8, 15 and 22, Takase'535 discloses wherein the traffic information 
packet comprises a header (see FIG. 17B, Protocol Header 171) and one or more flow records 
(see FIG. 17B, Attribute Value); see col. 20, lines 5-42. 

In view of this, having the combined system of Hegde'875, Blandy and Dietz'099, then 
given the teaching of Takase'535, it would have been obvious to one having ordinary skill in the 
art at the time the invention was made to modify the combined system of Hegde'875, Blandy and 
Takase'535, for same purpose as described above in claim 7. 

5. Claims 26 and 27 are rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde 
in view of Blandy as described above in claim 23, and further in view of Hebb (U.S. 6,463,067). 

Regarding Claim 26, the combined system of Hegde and Blandy discloses all aspect of 
the claim as described above in claim 4, and Hegde discloses a source line card and forwarding 
the data packet. 

Neither Hegde nor Blandy explicitly discloses the source line card is performing 
processing of packet data (see FIG. 2, Forwarding Engine 22) is located on the source line card 
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(see FIG. 2, a line interface unit PHY 1/0 and Framing 20 unit; note that Forwarding Engine 22 
within interface card 20; col. 3, lines 55-60). 

In view of this, having the combined system of Hegde and Blandy, then given the 
teaching of Hebb, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to modify the combined system of Hegde and Blandy, for the purpose of 
providing processing packets within input line interface unit and sending the processed data to 
outgoing line interface unit, as taught by Hebb, since Hebb states the advantages/benefits at col. 
2, lines 25-54 that it would enhance the efficiency and speed of the communication between the 
packet process and the forwarding engine, and allowing for high-speed packet forwarding and 
classification. The motivation being that by processing the packet at the incoming port and 
forwarding to the switch fabric and the outgoing port, it can increase the performance of the 
network and enhance the packet classification since the packet is proceed at incoming port before 
traversing the router. 

Regarding claim 27, Hebb discloses wherein the one or more processing engines (see 
FIG. 2, Forwarding Engine 22) is located on the source line card (see FIG. 2, a line interface unit 
PHY 1/0 and Framing 20 unit; note that Forwarding Engine 22 within interface card 20; col. 3, 
lines 55-60). 

In view of this, having the combined system of Hegde and Blandy, then given the 
teaching of Hebb, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to modify the combined system of Hegde and Blandy, for the purpose of 
providing processing packets within input line interface unit and sending the processed data to 
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outgoing line interface unit, as taught by Hebb, for the same motivation as stated above in claim 
26. 

6. Claim 28 is rejected under 35 U.S.C. 103(a) as being unpatentable over Hegde'8755 
Blandy and Hebb'067, as applied to claim 23 above, and further in view of Dietz (U.S. 
6,651,099). 

Regarding claim 28, Hegde discloses determining if the data packet is part of one or 
more recorded traffic flows (see FIG. 8, S42, S44; see col. 2, lines 65 to col. 3, lines 9; see col. 9, 
lines 40-55; note that IP header is extracted and determined if the traffic flow is in the flow 
table); 

creating a new entry in a table if the group of information is not part of the one or more 
recorded traffic flows (see FIG. 8, S56; Forwarded to CPU for processing; col. 3, lines 2-6; note 
that when there is no entry of a flow in the flow table, the packet is forwarded to CPU to be 
processed. See FIG. 9, S88, S90, S94; the CPU updates the table with a new traffic flow; see 
FIG. 9, S72, S94; see col. 3, lines 3-5,see col. 10, lines 36-44, see col. 1 1, lines 65 to col. 12, 
lines 5); 

forwarding if the group of information is part of the one or more recorded traffic flows 
(see FIG. 8, S46, S50; see FIG. 12, SI 76; see col. 3, Une 4-10, see col. 10, lines 24-32; note that 
once the flow is identified and the address is resolved, the IP packet is forwarded according to 
the created/updated designated flow). 

Neither Hegde nor Blandy explicitly discloses the source line card is performing 
processing of packet data (see FIG. 2, Forwarding Engine 22) is located on the source line card 
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(see FIG. 2, a line interface unit PHY 1/0 and Framing 20 unit; note that Forwarding Engine 22 
within interface card 20; col. 3, lines 55-60). 

In view of this, having the combined system of Hegde and Blandy, then given the 
teaching of Hebb, it would have been obvious to one having ordinary skill in the art at the time 
the invention was made to modify the combined system of Hegde and Blandy, for the purpose of 
providing processing packets within input line interface unit and sending the processed data to 
outgoing line interface unit, as taught by Hebb, since Hebb states the advantages/benefits at col. 
2, lines 25-54 that it would enhance the efficiency and speed of the communication between the 
packet process and the forwarding engine, and allowing for high-speed packet forwarding and 
classification. The motivation being that by processing the packet at the incoming port and 
forwarding to the switch fabric and the outgoing port, it can increase the performance of the 
network and enhance the packet classification since the packet is proceed at incoming port before 
traversing the router. 

Neither Hegde'875, Blandy nor Hebb explicitly disclose incrementing a field in an 
existing entry in the table; and time stamping the group of information. 

However, the above-mentioned claimed limitations are taught by Dietz'099. In particular, 
Dietz'099 teaches incrementing a field (see col. 24, lines 55-56, see col. 14, lines 54-56; a packet 
count in the counters, and note that when counting, the data must be incremented) in an existing 
entry in the table (see FIG. 3, Flow entry database) if the group of information is part of the one 
or more recorded traffic flows (see FIG. 3, steps 316 and 322; see col. 14, lines 3-35, 48-57; see 
col. 24, lines 50-59; note that when the packet is found to have a match flow-entry in the 
database 324, the calculator enters the measured statistical data in the flow-entry); and 
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time stamping the group of information (see col. 20, line 40-65; note that the time stamps 
are generated, collected, and analyzed for each packet of the flow). 

In view of this, having the combined system of Hegde'875, Blandy, Hebb then given the 
teaching of Dietz'099, it would have been obvious to one having ordinary skill in the art at the 
time the invention was made to modify the combined system of Hegde'875, Blandy and Hebb, 
for the purpose of providing a mechanism of collecting traffic flows in the flow-entry database 
by utilizing counters, and time stamping the packet, as taught by Dietz'099, since Dietz'099 states 
the advantages^enefits at col. 4, lines 40 to col. 5, lines 10 that it would recognize and classify 
all flows that pass either direction of the network and tune the performance of the network. The 
motivation being that by collection the traffic flow information, it enhance the performance of 
the network since the resources are being monitored and occurrences of specific sequences of 
packets are being reported. 

7. Claims 29 and 30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hegde'875, Blandy, Hebb, and Dietz'099, as applied to claim 28 above, and further in view of 
Takase (U.S. 5,822,535). 

Regarding claim 29, the combined system of Hegde'875, Blandy, Hebb'067 and 
Dietz'099 discloses the processing of the group of information for network traffic data collection 
as described above in claims 1 and 6. Hegde'875 further discloses a network traffic data 
collection application (see FIG. 2, Flow Table 70). Dietz'099 also discloses a network traffic data 
collection application (see FIG. 11, Lookup/update Engine LUE 1 107). 
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Neither Hegde'875, Blandy, Hebb'067, nor Dietz'099 explicitly disclose creating a traffic 
information packet; and transmitting the traffic information packet. 

However, the above-mentioned claimed limitations are taught by Takase'535. In 
particular, Takase'535 teaches creating a traffic information packet (see FIG. 17B, Response 
Packet; see col. 2, lines 55-61; see col. 20, lines 5-30; see FIG. 7, Steps S5-S7; note that upon 
receiving the call/request packet 401 from the management node 100, the managed node 301 
creates a response packet after collecting and accumulating according to the inquiry); and 

transmitting the traffic information packet to a network traffic data collection application 
(see FIG. 2, software application Management system 400 of the Management node 1 00; see 
FIG. 7, S8; the response packet is transmitted to the software application management system 
400; see col. 7, lines 50 to col. 9, lines 6). 

In view of this, having the combined system of Hegde'875, Blandy, Hebb'067 and 
Dietz'099, then given the teaching of Takase'535, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify the combined system of 
Hegde'875, Blandy, Hebb'067 and Dietz'099, for the purpose of providing a mechanism of 
transmitting a collected response packet to the collection management application system upon 
inquiry, as taught by Takase'535, since Takase'535 states the advantages/benefits at col. 2, lines 
45 to col. 3, lines 40 that it would reduce the amount of traffic flow in the network by preventing 
concentration of network load. The motivation being that by transmitting collected response 
packet only upon request to the management software application, it can reduce the network 
congestion since the collected packet is transmitted only upon request. 
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Regarding claim 30, Takase'535 discloses wherein the traffic information packet 
comprises a header (see FIG. 17B, Protocol Header 171) and one or more flow records (see FIG. 
17B, Attribute Value); see col. 20, lines 5-42, 

In view of this, having the combined system of Hegde'875, Blandy, Hebb'067 and 
Dietz'099, then given the teaching of Takase'535, it would have been obvious to one having 
ordinary skill in the art at the time the invention was made to modify the combined system of 
Hegde'875, Blandy, Hebb'067 and Dietz'099, for same motivation as described above in claim 
29. 

Response to Arguments 

8. Applicant's arguments filed 9/23/2005 have been fully considered but they are not 
persuasive. 

Regarding claims 1,9,16 and 23, the applicant argued that, "...determining whether to 
process the group of information for network traffic data collection. . .neither the cited sections of 
Hegde nor additional references discloses this claim limitation... Hegde is not network traffic 
data collection ...Hegde do not relate to selecting a group of information based on an 
examination of traffic data in that group of information..." in page 9, last paragraph; page 10, 
paragraph 1, 4; page 11, paragraph 1 . 

In response to applicant's argument, the examiner respectfully disagrees with the 
argument above. 

Hegde discloses determine whether to process the group of information (see FIG. 2, IP 
packet; see col. 4, lines 34-53, see col. 5, lines 30-50; see FIG. 7, S30 and S32; see col. 8, lines 
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250 to col, 9, lines 390) for network traffic data collection (see FIG. 8, S42, S44; see col. 2, lines 
65 to col. 3, lines 9; see col. 9, lines 40-55; note that IP header is extracted and determined if the 
flow (i.e. source and destination) is in the flow table for updating/creating the new forwarding 
information in the flow table 70 (also see FIG. 5)), 

selecting the group of information based on an examination of traffic attribute data (see 
FIG. 8, S48, S54, checking/getting/evaluation addresses in the packet header, then 
identifying/selecting) in the group of infonnation (see col. 9, lines 44-55; see col. 10, lines 35- 
42; flow in the IP packet). 

Regarding claims 1,9,16 and 23, the applicant argued that, "...Blandy presents no 
disclosure of manipulating network traffic data of any kind, including determining whether to 
process a group of information for network traffic data collection. . .Blandy does not provide any 
suggestion that this system performance monitoring method can be used to monitor network 
traffic data attributes or to perform network traffic data collection... Blandy does not teach 
sampling of network traffic data by any method... Blandy does not teach determining whether to 
process a group of information for network traffic data collection according to a burst sampling 
algorithm " in page 1 1, paragraph 2; page 11, paragraph 1; page 13, paragraph 1. 

In response to applicant's argument, the examiner respectfully disagrees with the 
argument above. Hegde discloses determining whether to process a group of information for 
network traffic data collection as set forth above and previous office action. Further, Blandy 
teaches determining is performed according to a sampling algorithm (see FIG. 2 and 3, sampling 
method) that is selected from one of a burst sampling algorithm (see col. 2, lines 64-66; see col. 
3, lines 12-19; col. 4, lines 26-50; sampling burst method); and selecting the group of 
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information based on an examination of traffic attribute data in the group of information (see 
FIG. 2, 33-39; see FIG. 3, 41-58; see col. 4, lines 30 to col. 6, lines 26; setting/allocating data 
according to time/count of traffic data). 

In response to applicant's arguments against the references individually, one cannot 
show nonobviousness by attacking references individually where the rejections are based on 
combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re 
Merck & Co,, 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). Thus, it is clear that the combined 
system of Hegde and Blandy discloses the argument limitation. 

Moreover, "sampling" or "burst sampling" is a well known mathematical 
process/algorithm, v/hich can be utilized anywhere when sampling "a group of information", and 
the combined system of Hegde and Blandy clearly disclose a burst sampling on "a group of 
information". 

The applicant argued that, "...there is no teaching, suggestion or motivation to 
combine Hegde with Blandy" in page 13, paragraph 2, page 14, paragraph 1-2. 

In response to applicant's argument that there is no suggestion to combine the references, 
the examiner recognizes that obviousness can only be established by combining or modifying the 
teachings of the prior art to produce the claimed invention where there is some teaching, 
suggestion, or motivation to do so found either in the references themselves or in the knowledge 
generally available to one of ordinary skill in the art See In re Fine, 837 F.2d 1071, 5 
USPQ2d 1596 (Fed. Cir. \9SS)md In re Jones, 958 F.2d 347,21 USPQ2d 1941 (Fed. Cir. 1992). 
In this case, it would have been obvious to one having ordinary skill in the art at the time the 
invention was made to provide a burst sampling algorithm, as taught by Blandy in the system of 
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Hegde, so that it would provide a performance system monitor system performance with minimal 
changes to the operating system and no changes to application code; also it would provides 
mechanism for monitoring system performance by sampling in a burst mode, rather than once 
per interrupt; see Blandy col. 2, line 55 to col. 3, lines 10. 

The applicant argued that, "...the office action... ignores the fact that the persent 
application and claims do not relate to operating system performance but rather network traffic 
data handling... .a person of ordinary skill in the art would not expect success combining Hegde 
with Blandy" in page 14, paragraph 1; page 15, paragraph 1. 

In response to applicant's argument that Blandy is nonanalogous art, it has been held 
that a prior art reference must either be in the field of applicant's endeavor or, if not, then be 
reasonably pertinent to the particular problem with which the applicant was concerned, in order 
to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 
F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 1992). Utilizing a mathematical "burst sampling" 
method/algorithm is well known in the art. In this case, Blandy is clearly disclosing such well 
known and established mathematical "burst sampling", and Blandy is also pertinent to a 
particular problem (i.e. burst sampling data/packet/group of information) with which the 
applicant was concerned. 

In response to applicant's argument that one would not expect success from 
combining, the test for obviousness is not whether the features of a secondary reference may be 
bodily incorporated into the structure of the primary reference; nor is it that the claimed 
invention must be expressly suggested in any one or all of the references. Rather, the test is what 
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the combined teachings of the references would have suggested to those of ordinary skill in the 
art. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981). 

In view of the above, the examiner respectfully disagrees with applicant's argument 
and believes that the combination of references as set forth in the 103 rejections is proper, thus. 
Claims 1,9, 16 and 23 are obvious over Hegde in view of Blandy for at least the reasons 
discussed above. 

Conclusion 

9. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

10. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Ian N. Moore whose telephone number is 571-272-3085. The 
examiner can normally be reached on 9:00 AM- 6:00 PM. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Chau Nguyen can be reached on 571-272-3 126. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
AppHcation Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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